[ClusterLabs] Missing or Permissive Content-Security-Policy frameancestors HTTP Response Header in pcsd

[Tomas Jelinek]

Hi,

Even if you disable the pcsd GUI, the daemon is still running and 
listening on port 2224. It is needed for pcs to be able to communicate 
with and manage cluster nodes. The fact the page is accessible is expected.

What pcs version are you running?


Regards,
Tomas


Dne 18. 05. 20 v 9:25 S Sathish S napsal(a):
> Hi Team,
> 
> We are getting below vulnerable alert while using pcs , we are not using 
> pcs Web UI interface can we know mitigation plan for this.
> 
> Plugin ID Â Â Â Â Â Â Â Â Â Â Â  :Â  50344
> 
> Plugin Name      : Missing or Permissive Content-Security-Policy 
> frameancestors HTTP Response Header
> 
> Port                     : TCP 2224
> 
> We have tried disabled Web UI interface and restart pcsd service , Still 
> page is accessible and login page display “PCSD GUI is disabled”
> 
> *Configuration File* :
> 
> # cat /etc/sysconfig/pcsd  | grep -i GUI
> 
> # Set DISABLE_GUI to true to disable GUI frontend in pcsd
> 
> PCSD_DISABLE_GUI=true
> 
> *Web UI Details* :
> 
> https://<IP Address>:2224/login <https://%3cIP%20Address%3e:2224/login>
> 
> Print “ PCSD GUI is disabled”
> 
> Can you suggest the way-forward for the same.
> 
> Thanks and Regards,
> 
> S Sathish S
> 
> 
> _______________________________________________
> Manage your subscription:
> https://lists.clusterlabs.org/mailman/listinfo/users
> 
> ClusterLabs home: https://www.clusterlabs.org/
>